BlackTreeCVE IntelligenceOctober 2025 Patch Tuesday3647332Normal patch window
SAP · 3647332
Linked CVE review
Assess and apply SAP security advisory 3647332
- Linked CVEs
- 1
- Confirmed exploited
- 0
- PoC or lab evidence
- 0
- Maximum CVSS
- 9.0
Confirmed exploitation, public exploit material, EPSS probability and CVSS severity answer different questions. “No confirmation recorded” means the checked sources do not currently confirm exploitation. It is not proof that exploitation has not occurred.
1 of 1 linked CVEs shown
Confirmed exploitedCVSS above 9.0
| CVE and description | Severity | Exploit reality | Forecast and access | Remediation |
|---|---|---|---|---|
CVE-2025-42910 Critical technical severity Unrestricted File Upload Vulnerability in SAP Supplier Relationship ManagementDue to missing verification of file type or content, SAP Supplier Relationship Management allows an authenticated attacker to upload arbitrary files. These files could include executables which might be downloaded and executed by the user which could host malware. On successful exploitation an attacker could cause high impact on confidentiality, integrity and availability of the application. | 9.0 · CVSS 3.1 · CriticalSource: CNA | No confirmation recordedNo CISA KEV match was present at the last successful refresh. This means no confirmation from that source, not proof of no exploitation.None recordedNo exploit-tagged reference or CISA SSVC proof-of-concept state is currently recorded. Research may still exist outside the structured feeds. | EPSS: 0.48% · 39.4th percentileForecast date: 2026-10-08NETWORK · LOW complexity · LOW privileges · REQUIRED user interaction | Within 7 daysCritical technical severity; prioritise exposed affected systems while verifying vendor guidance.Awaiting fix. No fixed version is explicitly recorded in the structured CVE data. |